From 2545b2d3d5fb8d52483379c8be0f6bb405b61883 Mon Sep 17 00:00:00 2001 From: Mahipal Date: Sun, 2 Aug 2026 05:59:37 -0700 Subject: [PATCH] Fix framework-ID defects across 53 skills (grounded in authoritative data) Deterministic audit against vendored MITRE/NIST oracles (ATT&CK v19.1, ATLAS 2026.07, NIST CSF 2.0, D3FEND v1.4.0) found and fixed: - 27 wrong-framework leaks on 12 AI-security skills: ATLAS AML.* IDs were under `mitre_attack` (-> `atlas_techniques`) and AI-RMF GOVERN/MEASURE IDs under `nist_csf` (-> `nist_ai_rmf`). - RS.AN-01 -> RS.AN-03 on 37 forensics/incident-analysis skills (CSF 1.1 ID retired in CSF 2.0; RS.AN-03 is the incident-analysis successor). - PR.DS-06 -> PR.DS-01 on the SLSA/Sigstore provenance skill (CSF 1.1 ID absorbed into PR.DS-01 in CSF 2.0; body prose updated too). - AML.T0104 -> AML.T0010 on 3 software-supply-chain skills (T0104 is "Publish Poisoned AI Agent Tool" -- wrong topic; T0010 "AI Supply Chain Compromise" is correct). CSF/ATLAS replacements verified against NIST CSWP.29, the official CSF 1.1->2.0 transition workbook, and mitre-atlas/atlas-data. Framework-ID gate: 0 defects. Schema: 817/817 pass. --- skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md | 1 - skills/analyzing-browser-forensics-with-hindsight/SKILL.md | 1 - skills/analyzing-disk-image-with-autopsy/SKILL.md | 1 - skills/analyzing-docker-container-forensics/SKILL.md | 1 - .../SKILL.md | 1 - skills/analyzing-linux-kernel-rootkits/SKILL.md | 1 - skills/analyzing-linux-system-artifacts/SKILL.md | 1 - skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md | 1 - skills/analyzing-mft-for-deleted-file-recovery/SKILL.md | 1 - skills/analyzing-outlook-pst-for-email-forensics/SKILL.md | 1 - .../analyzing-prefetch-files-for-execution-history/SKILL.md | 1 - .../analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md | 1 - .../analyzing-slack-space-and-file-system-artifacts/SKILL.md | 1 - skills/analyzing-supply-chain-malware-artifacts/SKILL.md | 1 - skills/analyzing-usb-device-connection-history/SKILL.md | 1 - skills/analyzing-windows-amcache-artifacts/SKILL.md | 1 - skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md | 1 - skills/analyzing-windows-prefetch-with-python/SKILL.md | 1 - skills/analyzing-windows-registry-for-artifacts/SKILL.md | 1 - skills/analyzing-windows-shellbag-artifacts/SKILL.md | 1 - skills/assessing-vector-and-embedding-weaknesses/SKILL.md | 4 ++-- skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md | 4 ++-- skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md | 4 ++-- skills/defending-llms-with-guardrails/SKILL.md | 4 ++-- skills/detecting-data-and-model-poisoning/SKILL.md | 4 ++-- skills/detecting-indirect-prompt-injection/SKILL.md | 4 ++-- skills/detecting-model-extraction-attacks/SKILL.md | 4 ++-- skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md | 1 - skills/extracting-browser-history-artifacts/SKILL.md | 1 - skills/extracting-credentials-from-memory-dump/SKILL.md | 1 - skills/extracting-windows-event-logs-artifacts/SKILL.md | 1 - skills/investigating-ransomware-attack-artifacts/SKILL.md | 1 - skills/orchestrating-llm-attacks-with-pyrit/SKILL.md | 4 ++-- skills/performing-cloud-forensics-investigation/SKILL.md | 1 - skills/performing-cloud-storage-forensic-acquisition/SKILL.md | 1 - skills/performing-file-carving-with-foremost/SKILL.md | 1 - skills/performing-linux-log-forensics-investigation/SKILL.md | 1 - .../SKILL.md | 1 - skills/performing-malware-persistence-investigation/SKILL.md | 1 - skills/performing-memory-forensics-with-volatility3/SKILL.md | 1 - .../SKILL.md | 1 - skills/performing-network-forensics-with-wireshark/SKILL.md | 1 - skills/performing-network-packet-capture-analysis/SKILL.md | 1 - skills/performing-sqlite-database-forensics/SKILL.md | 1 - skills/performing-steganography-detection/SKILL.md | 1 - skills/performing-timeline-reconstruction-with-plaso/SKILL.md | 1 - .../SKILL.md | 1 - skills/recovering-deleted-files-with-photorec/SKILL.md | 1 - skills/red-teaming-llms-with-garak/SKILL.md | 4 ++-- skills/securing-agentic-ai-tool-invocation/SKILL.md | 4 ++-- skills/testing-for-system-prompt-leakage/SKILL.md | 4 ++-- skills/testing-prompt-injection-in-rag-pipelines/SKILL.md | 4 ++-- skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md | 4 ++-- 53 files changed, 26 insertions(+), 66 deletions(-) diff --git a/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md b/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md index ac25ed4f..3ac54181 100644 --- a/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md +++ b/skills/acquiring-disk-image-with-dd-and-dcfldd/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-browser-forensics-with-hindsight/SKILL.md b/skills/analyzing-browser-forensics-with-hindsight/SKILL.md index 894030cb..92831541 100644 --- a/skills/analyzing-browser-forensics-with-hindsight/SKILL.md +++ b/skills/analyzing-browser-forensics-with-hindsight/SKILL.md @@ -20,7 +20,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-disk-image-with-autopsy/SKILL.md b/skills/analyzing-disk-image-with-autopsy/SKILL.md index 46896962..01908813 100644 --- a/skills/analyzing-disk-image-with-autopsy/SKILL.md +++ b/skills/analyzing-disk-image-with-autopsy/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-docker-container-forensics/SKILL.md b/skills/analyzing-docker-container-forensics/SKILL.md index b2ecb878..f09fa6ea 100644 --- a/skills/analyzing-docker-container-forensics/SKILL.md +++ b/skills/analyzing-docker-container-forensics/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md b/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md index 37497ee6..c738cdef 100644 --- a/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md +++ b/skills/analyzing-email-headers-for-phishing-investigation/SKILL.md @@ -18,7 +18,6 @@ license: Apache-2.0 atlas_techniques: - AML.T0052 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-linux-kernel-rootkits/SKILL.md b/skills/analyzing-linux-kernel-rootkits/SKILL.md index 7419d393..d4e00967 100644 --- a/skills/analyzing-linux-kernel-rootkits/SKILL.md +++ b/skills/analyzing-linux-kernel-rootkits/SKILL.md @@ -19,7 +19,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-linux-system-artifacts/SKILL.md b/skills/analyzing-linux-system-artifacts/SKILL.md index 761fb2bb..71e8fb44 100644 --- a/skills/analyzing-linux-system-artifacts/SKILL.md +++ b/skills/analyzing-linux-system-artifacts/SKILL.md @@ -16,7 +16,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md b/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md index 2f4a62e8..741eac1e 100644 --- a/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md +++ b/skills/analyzing-lnk-file-and-jump-list-artifacts/SKILL.md @@ -20,7 +20,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md b/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md index 9d962184..ceb7c384 100644 --- a/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md +++ b/skills/analyzing-mft-for-deleted-file-recovery/SKILL.md @@ -20,7 +20,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md b/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md index a958ad42..a4f4c6ff 100644 --- a/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md +++ b/skills/analyzing-outlook-pst-for-email-forensics/SKILL.md @@ -25,7 +25,6 @@ nist_ai_rmf: - MANAGE-3.1 - MEASURE-3.1 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-prefetch-files-for-execution-history/SKILL.md b/skills/analyzing-prefetch-files-for-execution-history/SKILL.md index d165f666..511ae2b1 100644 --- a/skills/analyzing-prefetch-files-for-execution-history/SKILL.md +++ b/skills/analyzing-prefetch-files-for-execution-history/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md b/skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md index cb110b8f..86cd3a56 100644 --- a/skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md +++ b/skills/analyzing-sbom-for-supply-chain-vulnerabilities/SKILL.md @@ -26,7 +26,6 @@ author: mukul975 license: Apache-2.0 atlas_techniques: - AML.T0010 -- AML.T0104 nist_ai_rmf: - GOVERN-5.2 - MAP-1.6 diff --git a/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md b/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md index 70fe7733..d141fade 100644 --- a/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md +++ b/skills/analyzing-slack-space-and-file-system-artifacts/SKILL.md @@ -16,7 +16,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-supply-chain-malware-artifacts/SKILL.md b/skills/analyzing-supply-chain-malware-artifacts/SKILL.md index d3790d72..2e823bf3 100644 --- a/skills/analyzing-supply-chain-malware-artifacts/SKILL.md +++ b/skills/analyzing-supply-chain-malware-artifacts/SKILL.md @@ -18,7 +18,6 @@ author: mahipal license: Apache-2.0 atlas_techniques: - AML.T0010 -- AML.T0104 nist_ai_rmf: - GOVERN-5.2 - MAP-1.6 diff --git a/skills/analyzing-usb-device-connection-history/SKILL.md b/skills/analyzing-usb-device-connection-history/SKILL.md index 3c14be18..8ed46c6c 100644 --- a/skills/analyzing-usb-device-connection-history/SKILL.md +++ b/skills/analyzing-usb-device-connection-history/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-windows-amcache-artifacts/SKILL.md b/skills/analyzing-windows-amcache-artifacts/SKILL.md index 18ece13c..752f6f13 100644 --- a/skills/analyzing-windows-amcache-artifacts/SKILL.md +++ b/skills/analyzing-windows-amcache-artifacts/SKILL.md @@ -23,7 +23,6 @@ version: 1.0.0 author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md b/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md index de40ae44..53a5cdb7 100644 --- a/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md +++ b/skills/analyzing-windows-lnk-files-for-artifacts/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-windows-prefetch-with-python/SKILL.md b/skills/analyzing-windows-prefetch-with-python/SKILL.md index a2fc9940..fd259cdf 100644 --- a/skills/analyzing-windows-prefetch-with-python/SKILL.md +++ b/skills/analyzing-windows-prefetch-with-python/SKILL.md @@ -22,7 +22,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-windows-registry-for-artifacts/SKILL.md b/skills/analyzing-windows-registry-for-artifacts/SKILL.md index 19d13e5a..189d0e95 100644 --- a/skills/analyzing-windows-registry-for-artifacts/SKILL.md +++ b/skills/analyzing-windows-registry-for-artifacts/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/analyzing-windows-shellbag-artifacts/SKILL.md b/skills/analyzing-windows-shellbag-artifacts/SKILL.md index 689b5a82..ddd14779 100644 --- a/skills/analyzing-windows-shellbag-artifacts/SKILL.md +++ b/skills/analyzing-windows-shellbag-artifacts/SKILL.md @@ -20,7 +20,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/assessing-vector-and-embedding-weaknesses/SKILL.md b/skills/assessing-vector-and-embedding-weaknesses/SKILL.md index 3206f414..8e8637e2 100644 --- a/skills/assessing-vector-and-embedding-weaknesses/SKILL.md +++ b/skills/assessing-vector-and-embedding-weaknesses/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.7 -mitre_attack: +atlas_techniques: - AML.T0024 --- # Assessing Vector and Embedding Weaknesses diff --git a/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md b/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md index 13cd1926..5dfdbfc9 100644 --- a/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md +++ b/skills/auditing-mcp-servers-for-tool-poisoning/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MANAGE-2.2 -mitre_attack: +atlas_techniques: - AML.T0010 --- # Auditing MCP Servers for Tool Poisoning diff --git a/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md b/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md index 92a5bc31..e02e66d8 100644 --- a/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md +++ b/skills/continuous-llm-red-teaming-with-promptfoo/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MANAGE-4.1 -mitre_attack: +atlas_techniques: - AML.T0051 --- # Continuous LLM Red Teaming with Promptfoo diff --git a/skills/defending-llms-with-guardrails/SKILL.md b/skills/defending-llms-with-guardrails/SKILL.md index 934a092d..36752c34 100644 --- a/skills/defending-llms-with-guardrails/SKILL.md +++ b/skills/defending-llms-with-guardrails/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MANAGE-2.1 -mitre_attack: +atlas_techniques: - AML.T0054 --- # Defending LLMs with Guardrails diff --git a/skills/detecting-data-and-model-poisoning/SKILL.md b/skills/detecting-data-and-model-poisoning/SKILL.md index b3b618e7..6c3c491a 100644 --- a/skills/detecting-data-and-model-poisoning/SKILL.md +++ b/skills/detecting-data-and-model-poisoning/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.7 -mitre_attack: +atlas_techniques: - AML.T0020 - AML.T0018 --- diff --git a/skills/detecting-indirect-prompt-injection/SKILL.md b/skills/detecting-indirect-prompt-injection/SKILL.md index ce66519a..858d4060 100644 --- a/skills/detecting-indirect-prompt-injection/SKILL.md +++ b/skills/detecting-indirect-prompt-injection/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.7 -mitre_attack: +atlas_techniques: - AML.T0051.001 --- # Detecting Indirect Prompt Injection diff --git a/skills/detecting-model-extraction-attacks/SKILL.md b/skills/detecting-model-extraction-attacks/SKILL.md index 7d6d6aa1..94e0c43a 100644 --- a/skills/detecting-model-extraction-attacks/SKILL.md +++ b/skills/detecting-model-extraction-attacks/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.6 -mitre_attack: +atlas_techniques: - AML.T0024 --- # Detecting Model Extraction Attacks diff --git a/skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md b/skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md index b0ac8eb0..27032060 100644 --- a/skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md +++ b/skills/detecting-supply-chain-attacks-in-ci-cd/SKILL.md @@ -20,7 +20,6 @@ author: mahipal license: Apache-2.0 atlas_techniques: - AML.T0010 -- AML.T0104 nist_ai_rmf: - GOVERN-5.2 - MAP-1.6 diff --git a/skills/extracting-browser-history-artifacts/SKILL.md b/skills/extracting-browser-history-artifacts/SKILL.md index 0136542e..e725740b 100644 --- a/skills/extracting-browser-history-artifacts/SKILL.md +++ b/skills/extracting-browser-history-artifacts/SKILL.md @@ -16,7 +16,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/extracting-credentials-from-memory-dump/SKILL.md b/skills/extracting-credentials-from-memory-dump/SKILL.md index d817d809..f67025bf 100644 --- a/skills/extracting-credentials-from-memory-dump/SKILL.md +++ b/skills/extracting-credentials-from-memory-dump/SKILL.md @@ -53,7 +53,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/extracting-windows-event-logs-artifacts/SKILL.md b/skills/extracting-windows-event-logs-artifacts/SKILL.md index 35dd61a1..a5e95e4e 100644 --- a/skills/extracting-windows-event-logs-artifacts/SKILL.md +++ b/skills/extracting-windows-event-logs-artifacts/SKILL.md @@ -16,7 +16,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/investigating-ransomware-attack-artifacts/SKILL.md b/skills/investigating-ransomware-attack-artifacts/SKILL.md index 6928b843..fe56073d 100644 --- a/skills/investigating-ransomware-attack-artifacts/SKILL.md +++ b/skills/investigating-ransomware-attack-artifacts/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md b/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md index 2fa6bf1b..3646e632 100644 --- a/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md +++ b/skills/orchestrating-llm-attacks-with-pyrit/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.7 -mitre_attack: +atlas_techniques: - AML.T0051 - AML.T0054 --- diff --git a/skills/performing-cloud-forensics-investigation/SKILL.md b/skills/performing-cloud-forensics-investigation/SKILL.md index 07818fc9..3e3fb235 100644 --- a/skills/performing-cloud-forensics-investigation/SKILL.md +++ b/skills/performing-cloud-forensics-investigation/SKILL.md @@ -16,7 +16,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-cloud-storage-forensic-acquisition/SKILL.md b/skills/performing-cloud-storage-forensic-acquisition/SKILL.md index f2c13dfb..bb486670 100644 --- a/skills/performing-cloud-storage-forensic-acquisition/SKILL.md +++ b/skills/performing-cloud-storage-forensic-acquisition/SKILL.md @@ -28,7 +28,6 @@ atlas_techniques: - AML.T0066 - AML.T0082 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-file-carving-with-foremost/SKILL.md b/skills/performing-file-carving-with-foremost/SKILL.md index 93bf36cd..7a4f57e3 100644 --- a/skills/performing-file-carving-with-foremost/SKILL.md +++ b/skills/performing-file-carving-with-foremost/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-linux-log-forensics-investigation/SKILL.md b/skills/performing-linux-log-forensics-investigation/SKILL.md index 57035f1c..d89fd909 100644 --- a/skills/performing-linux-log-forensics-investigation/SKILL.md +++ b/skills/performing-linux-log-forensics-investigation/SKILL.md @@ -20,7 +20,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-log-analysis-for-forensic-investigation/SKILL.md b/skills/performing-log-analysis-for-forensic-investigation/SKILL.md index dc22f1c7..0387de78 100644 --- a/skills/performing-log-analysis-for-forensic-investigation/SKILL.md +++ b/skills/performing-log-analysis-for-forensic-investigation/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-malware-persistence-investigation/SKILL.md b/skills/performing-malware-persistence-investigation/SKILL.md index 5efe3ccf..8b9ad741 100644 --- a/skills/performing-malware-persistence-investigation/SKILL.md +++ b/skills/performing-malware-persistence-investigation/SKILL.md @@ -22,7 +22,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-memory-forensics-with-volatility3/SKILL.md b/skills/performing-memory-forensics-with-volatility3/SKILL.md index 1b0be53b..2a4cfe7a 100644 --- a/skills/performing-memory-forensics-with-volatility3/SKILL.md +++ b/skills/performing-memory-forensics-with-volatility3/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md b/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md index db969936..a91fc769 100644 --- a/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md +++ b/skills/performing-mobile-device-forensics-with-cellebrite/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-network-forensics-with-wireshark/SKILL.md b/skills/performing-network-forensics-with-wireshark/SKILL.md index 25a4ab1a..9e22523a 100644 --- a/skills/performing-network-forensics-with-wireshark/SKILL.md +++ b/skills/performing-network-forensics-with-wireshark/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-network-packet-capture-analysis/SKILL.md b/skills/performing-network-packet-capture-analysis/SKILL.md index 68bf475b..b420106d 100644 --- a/skills/performing-network-packet-capture-analysis/SKILL.md +++ b/skills/performing-network-packet-capture-analysis/SKILL.md @@ -21,7 +21,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-sqlite-database-forensics/SKILL.md b/skills/performing-sqlite-database-forensics/SKILL.md index 59a8ec3a..da954b99 100644 --- a/skills/performing-sqlite-database-forensics/SKILL.md +++ b/skills/performing-sqlite-database-forensics/SKILL.md @@ -20,7 +20,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-steganography-detection/SKILL.md b/skills/performing-steganography-detection/SKILL.md index 6922ab14..63e2a9ff 100644 --- a/skills/performing-steganography-detection/SKILL.md +++ b/skills/performing-steganography-detection/SKILL.md @@ -15,7 +15,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-timeline-reconstruction-with-plaso/SKILL.md b/skills/performing-timeline-reconstruction-with-plaso/SKILL.md index c7a7ad54..90c2a35e 100644 --- a/skills/performing-timeline-reconstruction-with-plaso/SKILL.md +++ b/skills/performing-timeline-reconstruction-with-plaso/SKILL.md @@ -16,7 +16,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md b/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md index 3181e1cd..454bb060 100644 --- a/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md +++ b/skills/performing-windows-artifact-analysis-with-eric-zimmerman-tools/SKILL.md @@ -23,7 +23,6 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/recovering-deleted-files-with-photorec/SKILL.md b/skills/recovering-deleted-files-with-photorec/SKILL.md index cf9f1118..6c4e8cc8 100644 --- a/skills/recovering-deleted-files-with-photorec/SKILL.md +++ b/skills/recovering-deleted-files-with-photorec/SKILL.md @@ -23,7 +23,6 @@ atlas_techniques: - AML.T0066 - AML.T0082 nist_csf: -- RS.AN-01 - RS.AN-03 - DE.AE-02 - RS.MA-01 diff --git a/skills/red-teaming-llms-with-garak/SKILL.md b/skills/red-teaming-llms-with-garak/SKILL.md index e7c772ee..9693a477 100644 --- a/skills/red-teaming-llms-with-garak/SKILL.md +++ b/skills/red-teaming-llms-with-garak/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.7 -mitre_attack: +atlas_techniques: - AML.T0051 - AML.T0054 --- diff --git a/skills/securing-agentic-ai-tool-invocation/SKILL.md b/skills/securing-agentic-ai-tool-invocation/SKILL.md index 48528c3b..9b4365f2 100644 --- a/skills/securing-agentic-ai-tool-invocation/SKILL.md +++ b/skills/securing-agentic-ai-tool-invocation/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - GOVERN-1.3 -mitre_attack: +atlas_techniques: - AML.T0053 --- # Securing Agentic AI Tool Invocation diff --git a/skills/testing-for-system-prompt-leakage/SKILL.md b/skills/testing-for-system-prompt-leakage/SKILL.md index 3f572d4a..790b4e49 100644 --- a/skills/testing-for-system-prompt-leakage/SKILL.md +++ b/skills/testing-for-system-prompt-leakage/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.7 -mitre_attack: +atlas_techniques: - AML.T0057 --- # Testing for System Prompt Leakage diff --git a/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md b/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md index 2aff35a5..7420263c 100644 --- a/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md +++ b/skills/testing-prompt-injection-in-rag-pipelines/SKILL.md @@ -15,9 +15,9 @@ tags: version: '1.0' author: mahipal license: Apache-2.0 -nist_csf: +nist_ai_rmf: - MEASURE-2.7 -mitre_attack: +atlas_techniques: - AML.T0051 --- # Testing Prompt Injection in RAG Pipelines diff --git a/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md b/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md index 42e60b5b..03b54c0c 100644 --- a/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md +++ b/skills/verifying-build-provenance-with-slsa-sigstore/SKILL.md @@ -16,7 +16,7 @@ version: '1.0' author: mahipal license: Apache-2.0 nist_csf: -- PR.DS-06 +- PR.DS-01 mitre_attack: - T1195 --- @@ -28,7 +28,7 @@ Build-provenance verification answers a question that defeats many supply-chain This skill covers verifying signatures and SLSA provenance with **cosign** (`cosign verify`, `cosign verify-attestation`, `cosign verify-blob-attestation`) and **slsa-verifier** (`slsa-verifier verify-artifact`), enforcing the builder identity (the GitHub Actions workflow that produced the artifact) and the expected source repository. Keyless verification ties trust to an OIDC issuer (e.g., `https://token.actions.githubusercontent.com`) and a certificate identity rather than a long-lived private key. -This maps to MITRE ATT&CK **T1195 — Supply Chain Compromise** (provenance verification detects/blocks tampered artifacts) and NIST CSF **PR.DS-06** (integrity-checking mechanisms are used to verify software, firmware, and information integrity). +This maps to MITRE ATT&CK **T1195 — Supply Chain Compromise** (provenance verification detects/blocks tampered artifacts) and NIST CSF **PR.DS-01** (the confidentiality, integrity, and availability of data-at-rest are protected; CSF 2.0 absorbed the retired 1.1 PR.DS-06 integrity-checking outcome here). ## When to Use